CVE-2026-63121CWE-178

Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules

Medium · published October 30, 2026

CVSS v3.1
6.3
EPSS
—
In the wild
Unconfirmed
What it is

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, `trusted-repos-policy` compares an image's `registry` hostname against `reject lists` and `allow lists` case-sensitively even though `registry` DNS names are case-insensitive. An image with an uppercase or mixed-case `registry` hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image. Only reject-list configurations have this bypass: allow-list configurations fail closed by over-denying differently cased hostnames. The security consequences depend on the configured rejection policy and deployment environment. This issue is fixed in version 2.1.2.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
Not scored
Weakness
CWE-178 · Improper Handling of Case Sensitivity
Published
2026-10-30T22:08Z
Timeline
  • 30 OCT 22:08Z
    Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules
    cvelistv5
  • 30 OCT 22:08Z
    Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules
    cvelistv5